Investigating 'living off the pipe' in CI systems
A field note on a technique we're seeing more often: adversaries using build systems as a long-term C2.
Over the last two quarters we've been tracking a pattern we've started calling 'living off the pipe': adversary use of CI/CD runners as a long-term, low-friction command-and-control channel.
The pattern
The mechanics are straightforward: compromise a developer identity, push a build-graph change that introduces a benign-looking dependency, and let the runner execute arbitrary code with full repo and cloud credentials.
Why this is hard to see
Build systems are noisy. Network egress from runners is normal. Credentials are supposed to be ephemeral. Detections calibrated for endpoints miss all of it.
What we're doing about it
Vector ships a pipe-specific detection pack this quarter. It looks at build-graph deltas, runner-identity drift, and egress patterns in concert.